User Access 360

The question it answers: What can one user reach: roles, groups, licences, owned objects, devices, apps, Conditional Access policies and Send As rights?

Everything one user can reach, on one page: directory roles (active and eligible, direct or through groups), every group they are in (including nested), licences and how they were assigned, objects they own, their devices, enterprise apps assigned to them, Conditional Access policies that include or exclude them, and mailboxes they can send as. Helpdesk, audit and leaver checks all need this view.

Note

Full Access rights on other mailboxes are not listed - they need a scan of every mailbox. Use the CA What-If checker for an exact policy evaluation. This Entra ID report also lists the user’s Exchange Send As rights, so an API client with only the Entra ID grant reads them too.

At a glance

Where in the app	Entra ID › Identity Governance & Lifecycle › User Access 360
Workload	Entra ID
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for 10 minutes. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	None; PIM eligibility needs Entra ID P2.
Report id (API and MCP)	entra.governance.user-access-360

Columns

Column	Key	Type
Severity	Severity	Status
Access type	Category	Text
Item	Subject	Link
Check	Setting	Text
How	Value	Text
Note	Finding	Text
Detail	Detail	Text
Date	When	Date
Count	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

Parameters

Parameter	Key (API)	Required	Description
User principal name	upn	Yes	The user’s sign-in name (or object id).

What it needs

Licence: None; PIM eligibility needs Entra ID P2.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
GroupMember.Read.All	Microsoft Graph	Read all group memberships
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
Application.Read.All	Microsoft Graph	Read all applications
Device.Read.All	Microsoft Graph	Read all devices
Policy.Read.All	Microsoft Graph	Read your organization’s policies
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	Send As rights

Data sources it reads

• GET /v1.0/users/{upn}
• GET /v1.0/users/{id}/transitiveMemberOf
• GET /v1.0/users/{id}/ownedObjects
• GET /v1.0/users/{id}/registeredDevices
• GET /v1.0/users/{id}/appRoleAssignments
• GET /v1.0/identity/conditionalAccess/policies
• role assignments + PIM eligibility (cached)
• Get-EXORecipientPermission -Trustee {upn}

Through the API and MCP

GET /ir-api/v1/reports/entra.governance.user-access-360?size=100&upn=...

An AI assistant reads it with the MCP tool get_report and the id entra.governance.user-access-360. The client needs the Read grant for Entra ID. See Using the API.